Repository navigation
Backport workflow-hardening fix (excessive-permissions) to 5 release branches #3537
Description
Summary
The default branch already hardened .github/workflows/verify.yml against the issue(s) below, but 5 release branches still carry it. This proposes the same, minimal, scanner-verified fix for each.
What's flagged (by zizmor)
excessive-permissions— workflow/job granted broaderpermissionsthan needed
Already resolved on the default branch in:
Affected release branches (5)
release-0.24(still present as of HEAD4e7b7526)release-0.21(still present as of HEAD7fd020cb)release-0.22(still present as of HEADa19ec76a)release-0.19(still present as of HEAD5fe7bb3e)release-0.20(still present as of HEAD32e5e9e9)
Suggested per-branch patches
Each diff below was checked locally with zizmor and actionlint: the flagged finding(s) are cleared on the affected construct and no new lint or security findings are introduced. (Whitespace is normalized; only security-relevant lines change.)
release-0.24 — excessive-permissions
File .github/workflows/verify.yml; suggested edits:
-
- permissions.checks = 'write'
--- a/.github/workflows/verify.yml
+++ b/.github/workflows/verify.yml
@@ -16,3 +16,5 @@
PR_TITLE: ${{ github.event.pull_request.title }}
run: |
./hack/verify-pr-title.sh "${PR_TITLE}"
+permissions:
+ checks: writerelease-0.21 — excessive-permissions
File .github/workflows/verify.yml; suggested edits:
-
- permissions.checks = 'write'
--- a/.github/workflows/verify.yml
+++ b/.github/workflows/verify.yml
@@ -16,3 +16,5 @@
PR_TITLE: ${{ github.event.pull_request.title }}
run: |
./hack/verify-pr-title.sh "${PR_TITLE}"
+permissions:
+ checks: writerelease-0.22 — excessive-permissions
File .github/workflows/verify.yml; suggested edits:
-
- permissions.checks = 'write'
--- a/.github/workflows/verify.yml
+++ b/.github/workflows/verify.yml
@@ -16,3 +16,5 @@
PR_TITLE: ${{ github.event.pull_request.title }}
run: |
./hack/verify-pr-title.sh "${PR_TITLE}"
+permissions:
+ checks: writerelease-0.19 — excessive-permissions
File .github/workflows/verify.yml; suggested edits:
-
- permissions.checks = 'write'
--- a/.github/workflows/verify.yml
+++ b/.github/workflows/verify.yml
@@ -16,3 +16,5 @@
PR_TITLE: ${{ github.event.pull_request.title }}
run: |
./hack/verify-pr-title.sh "${PR_TITLE}"
+permissions:
+ checks: writerelease-0.20 — excessive-permissions
File .github/workflows/verify.yml; suggested edits:
-
- permissions.checks = 'write'
--- a/.github/workflows/verify.yml
+++ b/.github/workflows/verify.yml
@@ -16,3 +16,5 @@
PR_TITLE: ${{ github.event.pull_request.title }}
run: |
./hack/verify-pr-title.sh "${PR_TITLE}"
+permissions:
+ checks: writeHappy to open pull requests instead if that's preferred.
Activity
troy0820 commentedon Jul 16, 2026
release-19, release-20, release-21, release-22, are no longer maintained (n-2) but we may be able to do this for releaes-0.24.
Om-Beast commentedon Jul 23, 2026
Hi @troy0820, I'd be happy to work on backporting the workflow hardening fix to the
release-0.24branch if it's still needed. If that works for you, I'll open a PR targetingrelease-0.24. Thanks!k8s-triage-robot commentedon Oct 23, 2026
The Kubernetes project currently lacks enough contributors to adequately respond to all issues.
This bot triages un-triaged issues according to the following rules:
lifecycle/staleis appliedlifecycle/stalewas applied,lifecycle/rottenis appliedlifecycle/rottenwas applied, the issue is closedYou can:
/remove-lifecycle stale/closePlease send feedback to sig-contributor-experience at kubernetes/community.
/lifecycle stale